package org.eae.eldf.framework.security.service;

import java.util.Collection;
import java.util.Iterator;

import org.springframework.security.access.AccessDecisionManager;
import org.springframework.security.access.AccessDeniedException;
import org.springframework.security.access.ConfigAttribute;
import org.springframework.security.authentication.InsufficientAuthenticationException;
import org.springframework.security.core.Authentication;
import org.springframework.security.core.GrantedAuthority;


public class MyAccessDecisionManager implements AccessDecisionManager {

	@Override
	public void decide(Authentication authentication, Object arg1,
			Collection<ConfigAttribute> configAttributes) throws AccessDeniedException,
			InsufficientAuthenticationException {
		// TODO Auto-generated method stub
		 if (configAttributes == null) {  
	            return;  
	     }  
		// 所请求的资源拥有的权限(一个资源对多个权限)  
	        Iterator<ConfigAttribute> iterator = configAttributes.iterator();  
	        while (iterator.hasNext()) {  
	            ConfigAttribute configAttribute = iterator.next();  
	            // 访问所请求资源所需要的权限  
	            String needPermission = configAttribute.getAttribute();  
	            //logger.debug("[MyAccessDecisionManager] needPermission is " + needPermission);  
	            //System.out.println("[MyAccessDecisionManager] needPermission is " + needPermission);
	            // 用户所拥有的权限authentication  
	            for (GrantedAuthority ga : authentication.getAuthorities()) {  
	               // logger.debug("[MyAccessDecisionManager] ga.getAuthority() is " + ga.getAuthority());  
	                if (needPermission.contains((ga.getAuthority()))) {  
	                    return;  
	                }  
	            }  
	        }  
	        // 没有权限让我们去捕捉  
	        throw new AccessDeniedException(" 没有权限访问！");
	}

	@Override
	public boolean supports(ConfigAttribute arg0) {
		// TODO Auto-generated method stub
		return true;
	}

	@Override
	public boolean supports(Class<?> arg0) {
		// TODO Auto-generated method stub
		return true;
	}

}
